CVE-2026-12112 is a session management vulnerability in the foreman-mcp-server used by Red Hat Satellite. The MCP server improperly caches authenticated client connections and trusts non-secret session IDs without revalidating authentication tokens. Additionally, newly created session IDs are logged to standard logs, increasing exposure risk. This flaw allows unauthenticated attackers to hijack active administrative sessions, resulting in privilege escalation and the ability to execute code across the infrastructure. The vulnerability is associated with CWE-287 (Improper Authentication) and CWE-532 (Information Exposure Through Log Files). Red Hat has not yet provided a patch or practical mitigation for this issue. The advisory references Red Hat Satellite 6.19 and the satellite/foreman-mcp-server-rhel9 container image as affected components.

Successful exploitation allows an unauthenticated attacker to hijack administrative sessions, escalate privileges, and execute code infrastructure-wide. This can lead to full compromise of the affected Red Hat Satellite environment. The vulnerability impacts confidentiality, integrity, and availability of the system.

Red Hat has not identified any practical mitigation for this vulnerability at this time. Users should monitor Red Hat advisories and update the affected packages immediately once a fix becomes available. Until then, no specific workaround or mitigation is provided by Red Hat.